Critical PHP Vulnerabilities Expose Over Half of the Web to Serious Security Risks

Researchers have discovered critical vulnerabilities in PHP, a programming language that powers more than half of websites. Now organizations are trying to fix them, and it raises serious questions about the role of artificial intelligence in the future of cybersecurity. Also this week, we'll look at the latest twists in the Tesla and SpaceX merger saga, as well as a few deals that caught our eye, including a surprise $320 million investment AI-powered note-taking startup Otter. Welcome to the Equity podcast, TechCrunch's flagship project about the business of startups. I'm Kirsten Korosek, transportation editor at TechCrunch, and with

me, as always, are our co-hosts: senior special projects reporter Sean O'Kane and weekend editor Anthony Ha. Hello to you both. By the way, it was great to see you in person last week. Yes, mutually. I had a great time at Disrupt. Um, and I think, you know, I'm incredibly biased, but for me personally, taping this live episode of Equity was a real event. Yes, we had a full house, and you know, the only thing I'm a little jealous of is that on the last day, one of our reporters went early to see the movie that everyone's talking about right now, which is everyone's watching the

Elizabeth Holmes documentary. Um, and I wonder if any of you watched it over the weekend. I saw her twice, actually. Uh, unfortunately. So we balance each other out. Um, I have to say I watched it not because I was desperate, but because I was already planning to go with friends, and then my sister-in-law really wanted to see it. So I went with her too. And that's great. I strongly recommend it. I think unlike other Elizabeth Holmes stories that focus more on Silicon Valley culture, this movie focuses on her, and there are some really wild twists and turns that happen throughout the story. So I would highly recommend watching it as soon as possible, because it will become increasingly difficult to avoid spoilers later on.

Yes, I feel this pressure right now, it's really palpable. For example, I didn't have time to read Amanda's article or other materials written by people whose opinions I really want to know. And that's largely because the only theater in my city that shows it must have underestimated the popularity of this film, as they only bought the rights, it seems, until today, that is, at the time of the recording, or maybe it was already out of theaters on Wednesday, and it has n't been there since. So I'll have to get creative if I want to see this anytime soon Yes, definitely try it. While this was going on in the background, a few other big things happened, and, you know, probably the biggest explosion was a little thing called PHP. And it's not a drug, just so

you know. Ahem. That was my attempt at a joke, sorry. So, it's everywhere, and I'm wondering if any of you can just explain in general terms why everyone is talking about what one of our editors calls " PHP Armageddon." Yeah, I mean, it seems like the internet is breaking in a lot of ways this week, right? I think the best way to understand this, if people are coming across this for the first time, is to think about how many times in the last, say, 10 years we've had moments where something broke or almost broke, where one person, maintaining a tiny repository as a hobby or whatever, happens to notice something suspicious and saves the internet infrastructure from total collapse. Now multiply that by a billion, when people

have access not only to extremely advanced software in the form of these LLMs that everyone uses, but also to the ability to set them tasks, creating AI agents that purposefully do such things. And it seems like we're seeing a balance of two things happening this week. First, a number of labs and companies like Google and OpenAI have tasked people with finding a bunch of vulnerabilities, including the one in PHP, and second, we have a bunch of people who seem to be rushing to exploit these vulnerabilities to try to hack websites. So we have governments shutting down websites. We have very popular websites that are briefly down to fix this vulnerability. You know, this is a real moment of truth when we learn about the risks of having so

much of the internet built on open source technologies like PHP. You know, when you really get to the heart of the internet, it's held together by glue and dreams. And it's a rather difficult moment to think about this now I think we should fix the phrase that the Internet is held together by glue and dreams somewhere. Someone should definitely use this slogan. Well, I mean, there are so many amazing things about this situation, and one of them is that, as far as I understand-and I'm not a cybersecurity journalist-this is not a new vulnerability at all. This is a vulnerability that has existed in PHP for decades, and PHP, as you know, has been used as the programming language to build a large part of the web. So this vulnerability has existed

for decades, but no one just knew about it. And what happened, in fact, is this: big AI companies, including Wiz, which Google has now bought, were able to find these vulnerabilities using big language models, and the calculation was probably, "Oh, we need to fix this, because if we can find this vulnerability using LLM, then others can too, but the only way to release a patch is to announce the vulnerability itself." And this creates a kind of panic situation: they say, "Okay, this vulnerability has existed for decades. You should fix it immediately, and if you can't fix it immediately, just shut down your site. That's how serious a vulnerability it is Yes, I think it's important that many people don't even realize that their sites are running on PHP-

which, as you mentioned, is an open source programming language that's been around for decades. For those who don't know, the official term is Hypertext Preprocessor. I didn't know that. Yes. This is truly a key ingredient in content management systems used everywhere. So, WordPress, Drupal - about 70% of websites So we're talking about tens of millions of websites. For me, the main thing is scale. This also immediately made me think of two things. First: this is just the beginning. There will be something different. What other old, decade-old, low-quality software exists that would be exploited by hackers? And the second is what

404 Media mentioned, who had an excellent analysis of the topic, namely: link "rot". Because a lot of people, companies, governments, maybe even that little neighborhood website, they're shutting them down. And so we will have so many " dead" links, as well as websites that might have contained a piece of history that will no longer be accessible, instead of fixing them. So for me, it's like the immediate prospect, and then the more frightening, catastrophic, like, "Oh my God, what else is out there?" Yes, Anthony, I think you made a very valid point, because I've seen a lot of people unhappy with the disclosure here, the kind of bragging that Open AI seems to have allowed in their post about it. a few people got ahead of the embargo on this release, which

has sparked a kind of race among hackers. It seems to have been Cloudflare CEO Matthew Prince, who has already reported an escalation to millions of attempts to crack the PHP 2 shell. You know, the thing about these vulnerabilities, as it usually works in cybersecurity, is that if you're stress testing a company's software even if it's a fundamental piece of software that helps run many different computers or parts of the internet, you can go to that company and disclose it, and it stays within that "bubble," but when we're talking about something as deep and fundamental as this, you can't just go around telling everyone confidentially, right? Maybe you could, if AI was advanced enough

and you could instruct a billion agents to send an email to every person who controls a part of a website, you know, we now regret the days when we had webmasters who were easily identifiable, and maybe that would solve the problem to some extent. There's just no easy way to do it. So, I think we're really at the beginning of what will be a long fight, and this is certainly a new frontier in cybersecurity. Well, Matthew Prince's social media post was very telling and quite frightening to me. Also, I don't know if any of you have seen this, but Amazon also published a blog post. You know, this is a company with a lot of capital, so they have the tools and the

team to understand what's going on. They are effectively operating a "honeypot" network, or, more simply, a decoy. And they did see that there were attempts to exploit this vulnerability even before it was publicly disclosed. So, the activity was obvious. For me, it comes down again to Amazon having the tools, capital, and know-how to combat these things. There are so many websites and even potentially government resources that simply don't get this level of attention. So for me, this is probably the scariest part. And I think some AI people would probably take this to the level of apocalyptic predictions, because you can imagine how banks could be compromised, not to mention the data and privacy issues. It just feels much bigger than we can

fix right now. So I'm interested in observing two things. First, how extreme will people's behavior become. But I also wonder if this will lead to new startups, or if we will turn more to Nvidia's to build security layers. Yes, I mean, regarding your point about the level of concern and anxiety: when I first saw this, my instinct about panicking around AI usually said, "Oh, maybe it's not as serious as it seems." And one of the things that really impressed me was that with OpenAI and Hugging Face, there was a situation a few months ago where there was a lot of hype. But when you dug deeper and saw what cybersecurity experts were saying including the ones quoted in TechCrunch, they said, "Yes, this is very serious, this is a

real breach." And it's agents are doing this, but in terms of what actually happened, it's not that incredible. So in that case, it seemed like a lot of security professionals were trying to de-escalate the situation a little bit Hey, let's not lose our heads." It seems that this is not happening here. In this case, the cybersecurity community is not monolithic, but it's like, "No, this is a very, very real problem." And part of the problem is not that we already have some super-smart or super-powerful AI, but simply that I, and again, I think the 404 Media piece explained it perfectly: part of what a large language model (LLM) can do is essentially brute-force the internet. And it's not that she's super smart, it's that she's thorough.

That is, it can simply, if there is a vulnerability somewhere, probably find it and test everything in a row. Um, and so I can definitely imagine some opportunities here for startups, as far as I'm concerned. And I think we've talked about this in past episodes: what will cybersecurity look like, what will hacking look like in the future? The most obvious vision of this is, you know, agents against agents, where each one is trying to outdo the other. But, you know, for a problem of this magnitude, I wonder : is a startup solution something that most people would turn to? I don't know. Yes, I think that's what people are getting at when they talk about " doomsday" (pessimistic view), and it's not that this particular vulnerability is so advanced or anything like

that, or the exploit itself or the tools that are needed for it. The thing is that LLMs are able to find it and, as you said, attack it by brute force. And so we're really seeing this big shift, a kind of fundamental change both on the defense side, that is, the tools that are needed for cybersecurity, and on the attack side. And, you know, OpenAI, which I think you were referring to a minute ago, writes about this on their blog. It's a kind of double problem: AI can be useful for detecting these things. But AI can also be used to find these things and exploit them. So where does this lead us?

You know, this reminds me, by the way, a small digression, one of the Startup Battlefield finalists used AI agents to fight spam. And that's why you can see these scenarios. I just don't know how effective they will be and how many such companies there might be, you know, whether one will emerge as the leader, or whether there will be a whole bunch of small subcategories of companies that create AI agents to fight other agents on very narrow tasks. Yes, that Apate finalist from last week. Yes, I wonder if it protects people from scambots and the like. I wonder if they're thinking about expanding their horizons now that The only thing I would add and that I think is important to consider is: this is

not something that no one has guessed, right? A lot of people have spent the last few years trying to do simulations, and I think they've been largely ignored because people assumed they were just talking about this idea of AGI. But many of those who have tried to predict when the exponential growth of progress will truly begin have assumed that something similar might happen. And that makes me ask again the same question that we keep asking ourselves and that we asked during last week's live broadcast: why are n't these companies better prepared for this? I mean, in a sense they are ready because they are running programs like "patch the planet" and so on. But, you know, I still miss the returns from these big companies

that have a ton of resources. The post is good, and the program they're running is good, but I don't know, it feels like we're back in the same situation where they're just like that guy with the hot dogs. And that, you know, doesn't necessarily mean that they set it up, but their technology is being used for this, and many of us predicted this development. Yes, although, somewhat disputingly, I think part of the problem with discussing the risks of AI is that there are so many potential threats, so it becomes a question of which ones to take seriously. And this is where I become somewhat skeptical about a certain total nonsense, because I worry: if someone keeps talking about AGI, there's a feeling that, "well, if it doesn't come to that

, then maybe AI isn't a threat." And in this particular case, the situation is this: even if the AI is not very smart, it still creates, you know, this potential to detect these kinds of vulnerabilities. And so, you know, not to disagree with you, but I really think there are challenges here. And part of that challenge is distinguishing between what are immediate threats and what are long-term ones. I don't think we'll find a solution to this in this episode, so maybe we can move on to our other big topic. Yeah, let's just leave it as vague as possible. And then we have something much more encouraging, namely Elon Musk and his impact on his companies and on our society. I mean, it's been a few weeks, we didn't discuss this last week, and

there was a lot of news about Tesla, and also some news about SpaceX. Where should we start? Well, I think the most important thing here is that this week we had earnings reports from both SpaceX and Tesla back-to-back. And just as they're shortening the time between their earnings conferences, so is the distance between them as corporate entities, because we finally have an answer to the question many have been asking: not necessarily whether Tesla and SpaceX will merge, but when? And the answer is that both companies have created special committees to consider this idea and its feasibility. And you know, Musk made a pretty interesting facial expression. I always wonder when he decides to follow the rules

and when he doesn't. And in those moments, he always, you know, makes me feel like he's in a little school uniform, and he just says, "Oh," and I guess the few terms he uses, like having to dance kabuki or tiptoe through a minefield. It seems like he's trying to be very careful not to influence the outcome of this discussion that the boards of directors are having. Um, you know, largely because he was facing a very large, multi-year lawsuit over Solar City and its acquisition by Tesla. And so, you know, he's clearly listening to his lawyers, but he likes to act like he's not necessarily convinced that this is the best idea, although he sees reasons why it would be good, but it seems pretty obvious to me that everything is going to happen at some

point. And I have to assume that the only way that could happen is if Tesla were acquired by SpaceX, if only because the IPO gave him much more control over that company than he currently has at Tesla, where he only owns about 20% of the shares, and also because of the governance structure and everything else at SpaceX. It just seems more logical to me that this is the structure that will absorb Tesla. And so, you know, I think we'll see how this develops over the next few weeks or months. I don't know. What do you think, Kirsten? I would say by the end of the year. I really want, yes, I want to mention one thing: the special committee is made up of independent directors. And this is another one of those moments where I had to nod

my head a little and raise my eyebrows as I listened to it. This was during SpaceX's earnings report, and the next day, Tesla's report. So, on the Tesla board of directors there are two, so to speak, dependent or non- independent directors: Elon Musk and his brother Kimbal. And the rest are considered independent under Nasdaq rules. And SpaceX also has a number of independent directors. But if you look at their business connections and the fact that at least one of the current Tesla board members is also on the SpaceX board of directors. You know, a lot of things are connected there. These are also people, many of whom have been personal friends or investors of Elon Musk for a very long time. The only one who was actually recognized as not

independent and not a family member is Antonio Gracias. And, you know, he made a significant amount of money with Valor Equity Partners by investing in SpaceX and also entering into leaseback agreements for their AI computing power. So, they are so connected to this. He will clearly influence the outcome, regardless of whether he is sitting in that room or not. So, I think that's why it's inevitable. Um, that will dilute the stock. So, you know, I don't know, I'm curious to see how Tesla shareholders will take this information. Elon Musk also noted that it should be 50% of shareholders, not just 50% of votes. This means that a lot of people have to come out and vote for it to happen.

Yes, I mean, going back to what the board of directors can do, this special committee. I also thought about the metaphor of kabuki dance, although I am no kabuki dance expert. But one way to interpret this metaphor is that it's all just for show, right? That there is a version where the outcome is predetermined and I have to follow these formalities to avoid getting into trouble, where "I" is Elon Musk. But I wonder if anyone seriously takes the idea that the outcome might not be what they want. I'm also curious to see how much this will actually change day-to-day work. I suppose it will change, but I also think that for a long time, when he had a portfolio of companies, many of which are now combined under SpaceX, he treated them as one

company, right? That there was a significant sharing of resources, of employees, which I think sometimes made Tesla shareholders think, "Hey, wait a minute." "This is not how I think business should be run." But in the end, it didn't seem to stop him much, did it? No. No, I mean this has been going on for years. Yes. This continues in everything he does. You see Megapacks, their energy storage system, being used under the auspices of SpaceX, which now includes XAI. You see Tesla Cybertrucks being used at SpaceX. It's always been like that, even the Roadster story that Sean just wrote about, which happened on.when was it, Thursday? SpaceX engineers were involved. There are many intersections there.

Yes, it seems that Tesla's 10-Q report released this week indicated that SpaceX accounted for about 16% of accounts receivable, yes, there were always a lot of transactions going on between his companies. You know, I support your point, Anthony, Matt Levin from Bloomberg mentioned two points in his article this week that I think are very valid and put everything in its place. First, Musk has had a lot of crazy ideas over the years, and he's certainly gotten a lot of venture capital support, becoming quite close, as we said, with people like Antonio Gracias. But what he's trying to do now goes beyond even the large financial capabilities of today's venture capital environment, right? For example, he's trying to build a massive spaceport, a really

huge spaceport in Louisiana. He wants to create an incredibly large fleet of, you know, so-called orbital data centers. He wants to launch thousands of Starships a week, or whatever number there is now, you know, whatever big number he's fixated on. And these are just things that the venture capital community can't necessarily support on the scale that it wants to. So putting that together, and we've seen this before, because he was entering the debt markets even before the SpaceX IPO, the bigger you make these projects, the better your chances of accessing institutional funding sources that even surpass government capabilities. So this approach makes a lot of sense. And on your other point about how he's managing it, I want to read that from

Matt Levine's article because I think it's very apt. He writes: " Of course SpaceX and Tesla should merge. It's crazy that they're separate companies. One person runs two giant physical AI companies with huge overlaps. What a nightmare of conflicts of interest and bureaucracy. Just merge them so that one person can come into the office every day with a simple task: make decisions that will maximize the overall value of a large, complex company, etc. If chips, engineers, or drills are supposed to work on robots, let them work on robots." I think even from this perspective it makes a lot of sense. I will say that the end of Matt's section

on this merger supposedly suggests resolving many conflicts of interest by combining these companies. It might take one last big controversial deal to make it happen, which I find a very funny situation, especially at a time when there isn't much antitrust activity at the federal level. So, we have what we have. Yeah, you know, one last conflict of interest on the way. Um, I also think that all of this, while it's happening, and regardless of the outcome, is the backdrop for another statement- maybe the word "statement " is too loud-for the statement that Elon made recently that he's going to give every child in America a stake in SpaceX.

Um, which, yes, I found interesting for many reasons, but I'm curious what you, each of you, thought about it The timing for this is fantastic, because it was Sunday, I think it was Sunday, right? Anthropic announced that it is creating a kind of public benefit fund and intends to contribute 5% of its capital to it. It will grow according to certain milestones, with the idea that when Anthropic goes public in a couple of weeks or whenever that happens, its valuation will skyrocket and the rest of the world will somehow benefit. We don't know exactly how. It's just some LLC without a lot of information about it. They announced it, and then Musk just answers them with X, and it's a pattern that

I think repeats so often when you see him say, "You should do it differently." And then, a few hours later, boom, he announces that he wants to give a stake directly to all children under 18 in the United States, through this " Trump account," which was originally conceived as, "we'll give you a thousand dollars in an account, and it will grow with the stock market," and now it's turned into this weird thing where business executives can donate stock. So, you know, it's not that this idea was never in Elon's head, but it definitely got a boost when he saw what Anthropic did the other day. I'm sure he has a lot of ideas going through his head, and it all depends on when the right moment comes. In fact, many years ago I spoke to someone who worked for him

, and she said that the real gift he had, besides his risk-taking, was his ability to see the future and time things right. So, you know, I think this is just another example of that. I want to move on to a completely different outcome, instead of great successes and the absorption of giant companies by one. So, Character AI, this interactive chatbot platform, filed for bankruptcy, and now they're under the wing of Disney. And I'm wondering if any of you have been following this? I guess it shouldn't surprise me that it's Disney, simply because they have a lot of money and it's something they can influence, integrate into their company, which is so broad and huge, but it still made me wonder a little Yes, and I think the details of this have been

gradually emerging, because last week it became known that Character AI announced its intention to file for bankruptcy protection. And it seems that Disney's involvement was already somewhat known at that point, but by the end of the week it became clear that Disney had also committed to hiring the majority of Character AI's staff. Workforce, they are going to acquire some assets. Although, I think some of this is not yet resolved, because the company is going bankrupt. There is a possibility that other contenders will appear. Disney in this case is the initial buyer, setting the minimum price. And what also happened is that the former CEO of Character AI has already become the first CTO at Disney. So there were already a lot of connections there.

I suspect we will see more of these situations. Whether it's bankrupt AI companies or those that are just barely surviving, they're all being actively dismantled. I mean, in a lot of cases, it's AI companies or their technology partners that are doing it, but in this particular case, it seems like, you know, you could imagine that entertainment companies want to dive a little bit more into the world of AI as well. Yes, I've seen some people try to portray this as a " canary in the coal mine" for AI companies, but I think people forget that this was one of the first, if not the first, but one of the early, weird takeover deals, right? For example, Character AI was

founded by two, let's say, former Googlers who were quite well-known in this field. Noam Shazir is the most famous of them, and in 2024 Google made a move, rehiring these guys and a bunch of top talent from the company. And so, you know, Character AI was left on its own to become what it was meant to become. Almost like we saw with Scale AI and many others. So it's not a surprise to me in that regard. I know that filing for bankruptcy has allowed people to peer into the numbers of a rather seemingly unviable company. But, you know, for me it's just a consequence of that initial event that happened two years ago. And I don't know if there was any way for them to find a way out of the trajectory they were on, which ultimately led to bankruptcy.

I think we will see many more such deals aimed at recruiting talent. I think we're in for a lot of consolidation. And then we will probably see more optimistic takeover options. So, OpenAI, for example, just acquired a startup called Orchestra Bio, which I find very interesting because it's a biotech business. I think this shows very well what OpenAI is interested in developing. And they have a lot of money, so even though they spend it actively, they are well funded, and I think they are looking for opportunities to build their business. And this startup seems to have raised about 20 million. We don't know exactly how much this company was acquired for, but I can imagine that OpenAI and companies like them -Anthropic, OpenAI,

and others-are looking for such opportunities at earlier stages of startup development. So, in the first few years of their existence, they made deals to develop various aspects of their business. Yes, while we're talking about potentially new agreements of this type, I'd like to briefly express my displeasure with a linguistic point that Sean seems to have seen me discuss in Slack. But that's not at all the case with this OpenAI deal we're talking about, but it does describe to some extent what's happened repeatedly with Character AI. This is what used to be called a "reverse takeover" and is now just a "takeover", so the words don't mean anything anymore.

It's just a complete collapse of meaning. I accept this. In the future, I'll just use the word "absorption," but I wanted to say that it annoys me a little. Ahem. Let 's hold on. I mean, there are more aggressive terms we could use, if you want. Repeatedly abandoned. But in this deal, which is not one, at least as far as we know, it looks like a much more traditional acquisition. I think one interesting thing, as you said, is: what does this reveal about OpenAI's priorities? Especially, you know, just a few months ago we were talking a lot, and I saw a lot of reports, that OpenAI would not be doing, as they say, "side quests." You know, some of the people who worked on the scientific component left the company. And

I think part of it was that it was often about the consumer side. It was also about doing science because we find it interesting and cool, not about doing things related to science because we think it will make us a lot of money. We can do this, which is probably no surprise, but it's worth considering in the context of OpenAI's broader strategy. I want to squeeze in another deal. And this is not a takeover, so we will go back to traditional fundraising, but it is connected to artificial intelligence. And I think this will grab both of your attention, or probably has already, because we're talking about Otter AI raising 320 million from General Catalyst. And, you know, we're all familiar with Otter.

It seems we still use Otter at Disrupt every year. Yes, I was just saying a minute ago that there isn't enough money in the venture world to back the craziest ideas of SpaceX or maybe Tesla, but they certainly have a lot of funding. This is a significant amount, especially for a company that has only raised about 50 million to date. And you know, I think I'm probably not alone on this podcast when I see this happening, and it makes me worry: How is this going to affect the goals that a company like this has? This is a story as old as the world for Silicon Valley. For example, when there are venture capitalists who expect a large return by investing such funds, the tool I am currently using will likely undergo changes that

may make me no longer like it. So, I guess we'll see. Yes, that's exactly what I'm afraid of. And you know, it's complicated because I'm not going to say that the decisions that Otter makes are wrong for Otter itself. Especially when they raised so much money, even though they had venture funding before. Well, you know, I think we all used it mostly as a simple transcription tool. And it has done well with this for years. This is incredibly important for all of our workflows, but I also understand that if you're building a venture-backed startup, and that's what they're doing- fortunately or unfortunately- it's probably not enough, right? So they're already adding more and more AI tools, and it's not like it's completely destroying the

transcription process, but now it's like, "No, I don't want that. I don't want this. "Let me just get the text." And I imagine that will continue to be the case You know, Otter, if you're listening: I understand that you need to do this, but don't get rid of the basic transcription function. I beg you. We still need her. She still gives you so much favor among journalists, so please don't give up on that. On this note, I think our time is up. So, Equity will of course be back next week, and in the meantime you can follow us on Equity Pod on X and Threads. Equity hosts are TechCrunch reporters, producer-Teresa Laconcello, editor- Kell. Subscribe on YouTube or any convenient podcast platform and find out about upcoming events at techcrunch.com/events.

Thank you very much for listening, see you next time.